Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

Summary from NCSC UK.

Explained

The technology and terms in this story. Learn more

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-109618Critical 9.2Known exploitedEPSS 100.0%
• CVE-2026-109619Critical 9.2Known exploitedEPSS 100.0%

Related coverage

Other sources covering the same vulnerabilities or event.

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike11h agoVulnerabilitiesEndpointCVE-2026-109618CVE-2026-109619

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

Palo Alto Unit 4211h agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2

Canadian Centre for Cyber Security2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

PHP security advisory (AV26-1070) - Update 1

Canadian Centre for Cyber Security2d agoVulnerabilitiesCVE-2026-109618

U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Security Affairs2d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The Hacker News3d agoVulnerabilitiesAppSecCVE-2026-109618

PHP2Shell: What to know about two critical PHP flaws

ESET WeLiveSecurity3d agoVulnerabilitiesCVE-2026-109618CVE-2026-109619

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA Advisories3d agoVulnerabilitiesGovernanceCVE-2026-109618CVE-2026-109619

More in Vulnerabilities